virt

virt@lists.centos.org

1612 discussions

Xen 4.4 Immediate EOL
by Kevin Stange 22 Jan '18

22 Jan '18

Hi, I am very sorry to do this on short notice, but obviously Meltdown and Spectre are a lot more than anyone was really expecting to come down the pipeline. Xen 4.4 has been EOL upstream for about a year now and I have personally been reviewing and backporting patches based on the 4.5 versions made available upstream. Given that 4.5 is now also reaching EOL, backporting to 4.4 will become harder and I've already taken steps to vacate 4.4 in my own environment ASAP. Spectre and Meltdown patches most likely will only officially reach 4.6 and are very complicated. Ultimately, I don't think this is a constructive use of my time. Therefore, I will NOT be continuing to provide updated Xen 4.4 builds any longer through CentOS Virt SIG. If someone else would like to take on the job, you're welcome to try. Pop by #centos-virt on Freenode to talk to us there if you're interested. For short term mitigation of the Meltdown issue on 4.4 with PV domains, your best bet is probably to use the "Vixen" shim solution, which George has put into the xen-44 package repository per his email from two days ago. Vixen allows you to run PV domains inside HVM guest containers. It does not protect the guest from itself, but protects the domains from each other. Long term, your best bet is to try to get up to a new version of Xen that is under upstream security support, probably 4.8. -- Kevin Stange Chief Technology Officer Steadfast | Managed Infrastructure, Datacenter and Cloud Services 800 S Wells, Suite 190 | Chicago, IL 60607 312.602.2689 X203 | Fax: 312.602.2688 kevin(a)steadfast.net | www.steadfast.net

6 7

Centos 6 2.6.32-696.18.7.el6.x86_64 does not boot in Xen PV mode
by Dan 22 Jan '18

22 Jan '18

Is this now fixed in the latest release by updating the hypervisor, the same as CentOS 7? Or does this require something further? I came across https://access.redhat.com/solutions/3312501 which seems to suggest Redhat are working on resolving the issue, so if that's the case then maybe the solution implemented by CentOS is not the best option? Kind Regards, Dan

2 1

"Vixen" HVM shim package available in virt-xen-testing
by George Dunlap 18 Jan '18

18 Jan '18

To install the package: yum --enablerepo=virt-xen-VV-testing xen-vixen Where VV is '44', '46', or '48', depending on which version you're using. (It's the same package for all versions.) This will install the xen-vixen "shim" binary, as well as the pvshim-converter script. See XSA-254 [1] for detailed information about who should use it, why, and when. Please report both successes and failures here. :-) -George [1] https://xenbits.xen.org/xsa/advisory-254.html

1 1

Re: [CentOS-virt] CentOS-virt - Kernel Side-Channel Attacks
by Deviance 10 Jan '18

10 Jan '18

Is this CentOS-virt kernel compatible and recommended for KVM use or should I stick with 3.10? 4. jan. 2018 6:51 pop. je oseba <rikske(a)deds.nl> napisala: Please patch the CentOS-virt Kernel to fix the Kernel Side-Channel Attacks vulnerabilities. The latest CentOS-virt kernel was released in November, as seen below. kernel-4.9.63-29.el7.x86_64.rpm 2017-11-21 13:30 https://access.redhat.com/security/vulnerabilities/speculativeexecution http://mirror.centos.org/centos/7/virt/x86_64/xen/ _______________________________________________ CentOS-virt mailing list CentOS-virt(a)centos.org https://lists.centos.org/mailman/listinfo/centos-virt

1 0

Centos 7 Kernel 3.10.0-693.11.6.el7.x86_64 does not boot PV
by Shaun Reitan 09 Jan '18

09 Jan '18

Broken! [ 0.000000] Initializing cgroup subsys cpuset [ 0.000000] Initializing cgroup subsys cpu [ 0.000000] Initializing cgroup subsys cpuacct [ 0.000000] Linux version 3.10.0-693.11.6.el7.x86_64 (builder(a)kbuilder.dev.centos.org) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC) ) #1 SMP Thu Jan 4 01:06:37 UTC 2018 [ 0.000000] Command line: root=/dev/xvda ro crashkernel=auto rhgb [ 0.000000] ACPI in unprivileged domain disabled [ 0.000000] e820: BIOS-provided physical RAM map: [ 0.000000] Xen: [mem 0x0000000000000000-0x000000000009ffff] usable [ 0.000000] Xen: [mem 0x00000000000a0000-0x00000000000fffff] reserved [ 0.000000] Xen: [mem 0x0000000000100000-0x00000001007fffff] usable [ 0.000000] NX (Execute Disable) protection: active [ 0.000000] DMI not present or invalid. [ 0.000000] e820: last_pfn = 0x100800 max_arch_pfn = 0x400000000 [ 0.000000] e820: last_pfn = 0x100000 max_arch_pfn = 0x400000000 [ 0.000000] RAMDISK: [mem 0x02423000-0x02e8dfff] [ 0.000000] NUMA turned off [ 0.000000] Faking a node at [mem 0x0000000000000000-0x00000001007fffff] [ 0.000000] NODE_DATA(0) allocated [mem 0xff7fb000-0xff821fff] [ 0.000000] Reserving 161MB of memory at 720MB for crashkernel (System RAM: 4103MB) [ 0.000000] Zone ranges: [ 0.000000] DMA [mem 0x00001000-0x00ffffff] [ 0.000000] DMA32 [mem 0x01000000-0xffffffff] [ 0.000000] Normal [mem 0x100000000-0x1007fffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x00001000-0x0009ffff] [ 0.000000] node 0: [mem 0x00100000-0x1007fffff] [ 0.000000] Initmem setup node 0 [mem 0x00001000-0x1007fffff] [ 0.000000] SFI: Simple Firmware Interface v0.81 http://simplefirmware.org [ 0.000000] No local APIC present [ 0.000000] APIC: disable apic facility [ 0.000000] APIC: switched to apic NOOP [ 0.000000] smpboot: Allowing 4 CPUs, 0 hotplug CPUs [ 0.000000] PM: Registered nosave memory: [mem 0x000a0000-0x000fffff] [ 0.000000] e820: cannot find a gap in the 32bit address range [ 0.000000] e820: PCI devices with unassigned 32bit BARs may break! [ 0.000000] e820: [mem 0x100900000-0x100cfffff] available for PCI devices [ 0.000000] Booting paravirtualized kernel on Xen [ 0.000000] Xen version: 4.4.4-30.el6 (preserve-AD) [ 0.000000] setup_percpu: NR_CPUS:5120 nr_cpumask_bits:4 nr_cpu_ids:4 nr_node_ids:1 [ 0.000000] PERCPU: Embedded 35 pages/cpu @ffff8800ff400000 s104536 r8192 d30632 u524288 [ 0.000000] PV qspinlock hash table entries: 256 (order: 0, 4096 bytes) [ 0.000000] Built 1 zonelists in Node order, mobility grouping on. Total pages: 1034090 [ 0.000000] Policy zone: Normal [ 0.000000] Kernel command line: root=/dev/xvda ro crashkernel=auto rhgb [ 0.000000] PID hash table entries: 4096 (order: 3, 32768 bytes) [ 0.000000] Memory: 3916620k/4202496k available (6916k kernel code, 388k absent, 285488k reserved, 4551k data, 1800k init) [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1 [ 0.000000] x86/pti: Xen PV detected, disabling PTI protection [ 0.000000] Hierarchical RCU implementation. [ 0.000000] RCU restricting CPUs from NR_CPUS=5120 to nr_cpu_ids=4. [ 0.000000] NR_IRQS:327936 nr_irqs:48 0 [ 0.000000] Console: colour dummy device 80x25 [ 0.000000] console [tty0] enabled [ 0.000000] console [hvc0] enabled [ 0.000000] allocated 17301504 bytes of page_cgroup [ 0.000000] please try 'cgroup_disable=memory' option if you don't want memory cgroups [ 0.000000] installing Xen timer for CPU 0 [ 0.000000] tsc: Fast TSC calibration using PIT [ 0.000000] tsc: Detected 2000.135 MHz processor [ 0.002000] Calibrating delay loop (skipped), value calculated using timer frequency.. 4000.23 BogoMIPS (lpj=2000116) [ 0.002000] pid_max: default: 32768 minimum: 301 [ 0.002000] Security Framework initialized [ 0.002000] SELinux: Initializing. [ 0.002000] Yama: becoming mindful. [ 0.002410] Dentry cache hash table entries: 524288 (order: 10, 4194304 bytes) [ 0.004872] Inode-cache hash table entries: 262144 (order: 9, 2097152 bytes) [ 0.006027] Mount-cache hash table entries: 8192 (order: 4, 65536 bytes) [ 0.006063] Mountpoint-cache hash table entries: 8192 (order: 4, 65536 bytes) [ 0.006562] Initializing cgroup subsys memory [ 0.006594] Initializing cgroup subsys devices [ 0.006604] Initializing cgroup subsys freezer [ 0.006613] Initializing cgroup subsys net_cls [ 0.006621] Initializing cgroup subsys blkio [ 0.006630] Initializing cgroup subsys perf_event [ 0.006639] Initializing cgroup subsys hugetlb [ 0.006648] Initializing cgroup subsys pids [ 0.006655] Initializing cgroup subsys net_prio [ 0.006747] FEATURE SPEC_CTRL Not Present [ 0.006755] FEATURE IBPB_SUPPORT Not Present [ 0.006764] CPU: Physical Processor ID: 0 [ 0.006770] CPU: Processor Core ID: 0 [ 0.006783] Last level iTLB entries: 4KB 128, 2MB 4, 4MB 4 [ 0.006790] Last level dTLB entries: 4KB 256, 2MB 0, 4MB 32 [ 0.006797] tlb_flushall_shift: -1 [ 0.043464] ftrace: allocating 26616 entries in 104 pages [ 0.051172] cpu 0 spinlock event irq 17 [ 0.051211] smpboot: Max logical packages: 2 [ 0.051265] Performance Events: unsupported p6 CPU model 15 no PMU driver, software events only. [ 0.053927] NMI watchdog: disabled (cpu0): hardware events not enabled [ 0.053938] NMI watchdog: Shutting down hard lockup detector on all cpus [ 0.054083] installing Xen timer for CPU 1 [ 0.054104] cpu 1 spinlock event irq 24 [ 0.054161] SMP alternatives: switching to SMP code [ 0.002000] [Firmware Bug]: CPU1: APIC id mismatch. Firmware: ffff APIC: 1 [ 0.087130] installing Xen timer for CPU 2 [ 0.087158] cpu 2 spinlock event irq 31 [ 0.002000] [Firmware Bug]: CPU2: APIC id mismatch. Firmware: ffff APIC: 1 [ 0.087527] installing Xen timer for CPU 3 [ 0.087554] cpu 3 spinlock event irq 38 [ 0.002000] [Firmware Bug]: CPU3: APIC id mismatch. Firmware: ffff APIC: 1 [ 0.087723] Brought up 4 CPUs [ 0.088128] devtmpfs: initialized [ 0.097568] EVM: security.selinux [ 0.097576] EVM: security.ima [ 0.097582] EVM: security.capability [ 0.099417] atomic64 test passed for x86-64 platform with CX8 and with SSE [ 0.099440] pinctrl core: initialized pinctrl subsystem [ 0.099538] xen:grant_table: Grant tables using version 2 layout [ 0.099569] Grant table initialized [ 0.119476] RTC time: 165:165:165, date: 165/165/65 [ 0.119675] NET: Registered protocol family 16 [ 0.121015] PCI: setting up Xen PCI frontend stub [ 0.127086] ACPI: Interpreter disabled. [ 0.127121] xen:balloon: Initialising balloon driver [ 0.129017] random: fast init done [ 0.130054] xen_balloon: Initialising balloon driver [ 0.131072] vgaarb: loaded [ 0.131195] SCSI subsystem initialized [ 0.131195] usbcore: registered new interface driver usbfs [ 0.131195] usbcore: registered new interface driver hub [ 0.131195] usbcore: registered new device driver usb [ 0.131195] dmi: Firmware registration failed. [ 0.167027] PCI: System does not support PCI [ 0.167037] PCI: System does not support PCI [ 0.167215] NetLabel: Initializing [ 0.167224] NetLabel: domain hash size = 128 [ 0.167230] NetLabel: protocols = UNLABELED CIPSOv4 [ 0.167257] NetLabel: unlabeled traffic allowed by default [ 0.167295] amd_nb: Cannot enumerate AMD northbridges [ 0.167550] Switched to clocksource xen [ 0.178088] pnp: PnP ACPI: disabled [ 0.183638] NET: Registered protocol family 2 [ 0.184098] TCP established hash table entries: 32768 (order: 6, 262144 bytes) [ 0.184361] TCP bind hash table entries: 32768 (order: 7, 524288 bytes) [ 0.184596] TCP: Hash tables configured (established 32768 bind 32768) [ 0.184668] TCP: reno registered [ 0.184700] UDP hash table entries: 2048 (order: 4, 65536 bytes) [ 0.184758] UDP-Lite hash table entries: 2048 (order: 4, 65536 bytes) [ 0.184881] NET: Registered protocol family 1 [ 0.184995] Unpacking initramfs... [ 0.413365] Freeing initrd memory: 10668k freed [ 0.419848] platform rtc_cmos: registered platform RTC device (no PNP device found) [ 0.420928] sha1_ssse3: Using SSSE3 optimized SHA-1 implementation [ 0.421192] sha256_ssse3: Using SSSE3 optimized SHA-256 implementation [ 0.421874] futex hash table entries: 1024 (order: 4, 65536 bytes) [ 0.421934] Initialise system trusted keyring [ 0.421977] audit: initializing netlink socket (disabled) [ 0.422030] type=2000 audit(1515201065.163:1): initialized [ 0.455969] HugeTLB registered 2 MB page size, pre-allocated 0 pages [ 0.457842] zpool: loaded [ 0.457855] zbud: loaded [ 0.458117] VFS: Disk quotas dquot_6.5.2 [ 0.458176] Dquot-cache hash table entries: 512 (order 0, 4096 bytes) [ 0.458464] msgmni has been set to 7670 [ 0.458549] Key type big_key registered [ 0.461029] NET: Registered protocol family 38 [ 0.461048] Key type asymmetric registered [ 0.461057] Asymmetric key parser 'x509' registered [ 0.461108] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 250) [ 0.461283] io scheduler noop registered [ 0.461297] io scheduler deadline registered (default) [ 0.461362] io scheduler cfq registered [ 0.461522] pci_hotplug: PCI Hot Plug PCI Core version: 0.5 [ 0.461542] pciehp: PCI Express Hot Plug Controller Driver version: 0.4 [ 0.462648] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled [ 0.463550] Non-volatile memory driver v1.3 [ 0.463641] Linux agpgart interface v0.103 [ 0.463792] crash memory driver: version 1.1 [ 0.463898] rdac: device handler registered [ 0.464087] hp_sw: device handler registered [ 0.464099] emc: device handler registered [ 0.464109] alua: device handler registered [ 0.464189] libphy: Fixed MDIO Bus: probed [ 0.464329] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 0.464345] ehci-pci: EHCI PCI platform driver [ 0.464366] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 0.464379] ohci-pci: OHCI PCI platform driver [ 0.464396] uhci_hcd: USB Universal Host Controller Interface driver [ 0.464474] usbcore: registered new interface driver usbserial [ 0.464494] usbcore: registered new interface driver usbserial_generic [ 0.464510] usbserial: USB Serial support registered for generic [ 0.464544] i8042: PNP: No PS/2 controller found. Probing ports directly. [ 1.495394] i8042: No controller found [ 1.495593] mousedev: PS/2 mouse device common for all mice [ 1.556097] rtc_cmos rtc_cmos: rtc core: registered rtc_cmos as rtc0 [ 1.556211] rtc_cmos: probe of rtc_cmos failed with error -38 [ 1.556300] dmi-sysfs: dmi entry is absent. [ 1.556343] hidraw: raw HID events driver (C) Jiri Kosina [ 1.556508] usbcore: registered new interface driver usbhid [ 1.556520] usbhid: USB HID core driver [ 1.556575] drop_monitor: Initializing network drop monitor service [ 1.556688] TCP: cubic registered [ 1.556703] Initializing XFRM netlink socket [ 1.556865] NET: Registered protocol family 10 [ 1.557258] NET: Registered protocol family 17 [ 1.557280] mce: Unable to init device /dev/mcelog (rc: -5) [ 1.557403] microcode: CPU0 sig=0x6f6, pf=0x4, revision=0xcd [ 1.557421] microcode: CPU1 sig=0x6f6, pf=0x4, revision=0xcd [ 1.557453] microcode: CPU2 sig=0x6f6, pf=0x4, revision=0xcd [ 1.557484] microcode: CPU3 sig=0x6f6, pf=0x4, revision=0xcd [ 1.557635] microcode: Microcode Update Driver: v2.01 <tigran(a)aivazian.fsnet.co.uk>, Peter Oruba [ 1.558075] Loading compiled-in X.509 certificates [ 1.558128] Loaded X.509 cert 'CentOS Linux kpatch signing key: ea0413152cde1d98ebdca3fe6f0230904c9ef717' [ 1.558159] Loaded X.509 cert 'CentOS Linux Driver update signing key: 7f421ee0ab69461574bb358861dbe77762a4201b' [ 1.559033] Loaded X.509 cert 'CentOS Linux kernel signing key: 2cbc9870546343ca3ae120c2bceb984401955962' [ 1.559080] registered taskstats version 1 [ 1.561924] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff816ab65d [ 1.561924] [ 1.561953] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 3.10.0-693.11.6.el7.x86_64 #1 [ 1.561966] Call Trace: [ 1.561982] [<ffffffff816a5ea1>] dump_stack+0x19/0x1b [ 1.561996] [<ffffffff8169fd64>] panic+0xe8/0x20d [ 1.562009] [<ffffffff816ab65d>] ? __schedule+0x95d/0x9b0 [ 1.562009] [<ffffffff810ca4d0>] ? switched_to_idle+0x10/0x10 [ 1.562009] [<ffffffff810891bb>] __stack_chk_fail+0x1b/0x20 [ 1.562009] [<ffffffff816ab65d>] __schedule+0x95d/0x9b0 [ 1.562009] [<ffffffff816b3801>] ? __do_page_fault+0x171/0x450 [ 1.562009] [<ffffffff816b3b15>] ? do_page_fault+0x35/0x90 [ 1.562009] [<ffffffff816af8f8>] ? page_fault+0x28/0x30 [ 1.562009] [<ffffffff816afdda>] ? error_exit+0x2a/0x60 [ 1.562009] [<ffffffff816af53a>] ? retint_swapgs+0x5/0x6 -- Shaun Reitan NDCHost.com

3 5

Centos 7 Kernel 3.10.0-693.11.6.el7.x86_64 does not boot PV
by Caribe Schreiber 09 Jan '18

09 Jan '18

I thought I'd chime in and say that I'm seeing the same kernel-plus boot failure that Shaun Reitan reported earlier. Is there likely to be another build 3.10 kernel build coming down the pipeline that might fix this issue? Here's the output of my failed PV domU boot: [ 0.000000] Initializing cgroup subsys cpuset [ 0.000000] Initializing cgroup subsys cpu [ 0.000000] Initializing cgroup subsys cpuacct [ 0.000000] Linux version 3.10.0-693.11.6.el7.centos.plus.x86_64 ( builder(a)kbuilder.dev.centos.org) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-16) (GCC) ) #1 SMP Thu Jan 4 14:27:13 UTC 2018 [ 0.000000] Command line: root=/dev/xvda1 root=/dev/xvda1 [ 0.000000] ACPI in unprivileged domain disabled [ 0.000000] e820: BIOS-provided physical RAM map: [ 0.000000] Xen: [mem 0x0000000000000000-0x000000000009ffff] usable [ 0.000000] Xen: [mem 0x00000000000a0000-0x00000000000fffff] reserved [ 0.000000] Xen: [mem 0x0000000000100000-0x00000000ffffffff] usable [ 0.000000] NX (Execute Disable) protection: active [ 0.000000] DMI not present or invalid. [ 0.000000] e820: last_pfn = 0x100000 max_arch_pfn = 0x400000000 [ 0.000000] RAMDISK: [mem 0x0243e000-0x034befff] [ 0.000000] NUMA turned off [ 0.000000] Faking a node at [mem 0x0000000000000000-0x00000000ffffffff] [ 0.000000] NODE_DATA(0) allocated [mem 0xff802000-0xff828fff] [ 0.000000] Zone ranges: [ 0.000000] DMA [mem 0x00001000-0x00ffffff] [ 0.000000] DMA32 [mem 0x01000000-0xffffffff] [ 0.000000] Normal empty [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x00001000-0x0009ffff] [ 0.000000] node 0: [mem 0x00100000-0xffffffff] [ 0.000000] Initmem setup node 0 [mem 0x00001000-0xffffffff] [ 0.000000] SFI: Simple Firmware Interface v0.81 http://simplefirmware.org [ 0.000000] No local APIC present [ 0.000000] APIC: disable apic facility [ 0.000000] APIC: switched to apic NOOP [ 0.000000] smpboot: Allowing 4 CPUs, 0 hotplug CPUs [ 0.000000] PM: Registered nosave memory: [mem 0x000a0000-0x000fffff] [ 0.000000] e820: cannot find a gap in the 32bit address range [ 0.000000] e820: PCI devices with unassigned 32bit BARs may break! [ 0.000000] e820: [mem 0x100100000-0x1004fffff] available for PCI devices [ 0.000000] Booting paravirtualized kernel on Xen [ 0.000000] Xen version: 4.7.2 (preserve-AD) [ 0.000000] setup_percpu: NR_CPUS:5120 nr_cpumask_bits:4 nr_cpu_ids:4 nr_node_ids:1 [ 0.000000] PERCPU: Embedded 35 pages/cpu @ffff8800ff200000 s104600 r8192 d30568 u524288 [ 0.000000] PV qspinlock hash table entries: 256 (order: 0, 4096 bytes) [ 0.000000] Built 1 zonelists in Node order, mobility grouping on. Total pages: 1032074 [ 0.000000] Policy zone: DMA32 [ 0.000000] Kernel command line: root=/dev/xvda1 root=/dev/xvda1 [ 0.000000] PID hash table entries: 4096 (order: 3, 32768 bytes) [ 0.000000] x86/fpu: xstate_offset[2]: 0240, xstate_sizes[2]: 0100 [ 0.000000] xsave: enabled xstate_bv 0x7, cntxt size 0x340 using standard form [ 0.000000] Memory: 2194120k/4194304k available (6984k kernel code, 388k absent, 116588k reserved, 4581k data, 1800k init) [ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1 [ 0.000000] x86/pti: Xen PV detected, disabling PTI protection [ 0.000000] Hierarchical RCU implementation. [ 0.000000] RCU restricting CPUs from NR_CPUS=5120 to nr_cpu_ids=4. [ 0.000000] NR_IRQS:327936 nr_irqs:48 0 [ 0.000000] Console: colour dummy device 80x25 [ 0.000000] console [tty0] enabled [ 0.000000] console [hvc0] enabled [ 0.000000] allocated 16777216 bytes of page_cgroup [ 0.000000] please try 'cgroup_disable=memory' option if you don't want memory cgroups [ 0.000000] installing Xen timer for CPU 0 [ 0.000000] tsc: Fast TSC calibration failed [ 0.000000] tsc: Unable to calibrate against PIT [ 0.000000] tsc: No reference (HPET/PMTIMER) available [ 0.000000] tsc: Detected 2394.058 MHz processor [ 0.002000] Calibrating delay loop (skipped), value calculated using timer frequency.. 4788.11 BogoMIPS (lpj=2394058) [ 0.002000] pid_max: default: 32768 minimum: 301 [ 0.002000] Security Framework initialized [ 0.002000] SELinux: Initializing. [ 0.002000] Yama: becoming mindful. [ 0.002714] Dentry cache hash table entries: 524288 (order: 10, 4194304 bytes) [ 0.004757] Inode-cache hash table entries: 262144 (order: 9, 2097152 bytes) [ 0.005495] Mount-cache hash table entries: 8192 (order: 4, 65536 bytes) [ 0.005532] Mountpoint-cache hash table entries: 8192 (order: 4, 65536 bytes) [ 0.006056] Initializing cgroup subsys memory [ 0.006092] Initializing cgroup subsys devices [ 0.006104] Initializing cgroup subsys freezer [ 0.006116] Initializing cgroup subsys net_cls [ 0.006127] Initializing cgroup subsys blkio [ 0.006137] Initializing cgroup subsys perf_event [ 0.006149] Initializing cgroup subsys hugetlb [ 0.006160] Initializing cgroup subsys pids [ 0.006170] Initializing cgroup subsys net_prio [ 0.006302] ENERGY_PERF_BIAS: Set to 'normal', was 'performance' [ 0.006318] ENERGY_PERF_BIAS: View and update with x86_energy_perf_policy(8) [ 0.006331] FEATURE SPEC_CTRL Not Present [ 0.006339] FEATURE IBPB_SUPPORT Not Present [ 0.006351] CPU: Physical Processor ID: 0 [ 0.006362] CPU: Processor Core ID: 0 [ 0.006373] mce: CPU supports 2 MCE banks [ 0.006418] Last level iTLB entries: 4KB 512, 2MB 0, 4MB 0 [ 0.006429] Last level dTLB entries: 4KB 512, 2MB 32, 4MB 32 [ 0.006439] tlb_flushall_shift: 6 [ 0.060801] ftrace: allocating 26850 entries in 105 pages [ 0.074135] cpu 0 spinlock event irq 17 [ 0.074155] smpboot: Max logical packages: 1 [ 0.074216] Performance Events: unsupported p6 CPU model 45 no PMU driver, software events only. [ 0.076817] NMI watchdog: disabled (cpu0): hardware events not enabled [ 0.076834] NMI watchdog: Shutting down hard lockup detector on all cpus [ 0.076970] installing Xen timer for CPU 1 [ 0.077000] cpu 1 spinlock event irq 24 [ 0.077200] SMP alternatives: switching to SMP code [ 0.002000] [Firmware Bug]: CPU1: APIC id mismatch. Firmware: ffff APIC: 0 [ 0.119896] installing Xen timer for CPU 2 [ 0.119935] cpu 2 spinlock event irq 31 [ 0.002000] [Firmware Bug]: CPU2: APIC id mismatch. Firmware: ffff APIC: 0 [ 0.120440] installing Xen timer for CPU 3 [ 0.120477] cpu 3 spinlock event irq 38 [ 0.002000] [Firmware Bug]: CPU3: APIC id mismatch. Firmware: ffff APIC: 0 [ 0.120937] Brought up 4 CPUs [ 0.145051] node 0 initialised, 470802 pages in 24ms [ 0.146162] devtmpfs: initialized [ 0.152152] EVM: security.selinux [ 0.152168] EVM: security.ima [ 0.152176] EVM: security.capability [ 0.154191] atomic64 test passed for x86-64 platform with CX8 and with SSE [ 0.154214] pinctrl core: initialized pinctrl subsystem [ 0.154337] xen:grant_table: Grant tables using version 2 layout [ 0.154393] Grant table initialized [ 0.174361] RTC time: 165:165:165, date: 165/165/65 [ 0.174560] NET: Registered protocol family 16 [ 0.175213] random: fast init done [ 0.177033] PCI: setting up Xen PCI frontend stub [ 0.182179] ACPI: Interpreter disabled. [ 0.183029] xen:balloon: Initialising balloon driver [ 0.187043] xen_balloon: Initialising balloon driver [ 0.187130] vgaarb: loaded [ 0.187131] SCSI subsystem initialized [ 0.187244] usbcore: registered new interface driver usbfs [ 0.187291] usbcore: registered new interface driver hub [ 0.188102] usbcore: registered new device driver usb [ 0.188102] dmi: Firmware registration failed. [ 0.188140] PCI: System does not support PCI [ 0.188156] PCI: System does not support PCI [ 0.188156] NetLabel: Initializing [ 0.188156] NetLabel: domain hash size = 128 [ 0.188156] NetLabel: protocols = UNLABELED CIPSOv4 [ 0.188156] NetLabel: unlabeled traffic allowed by default [ 0.188156] amd_nb: Cannot enumerate AMD northbridges [ 0.189005] Switched to clocksource xen [ 0.199769] pnp: PnP ACPI: disabled [ 0.205228] NET: Registered protocol family 2 [ 0.205683] TCP established hash table entries: 32768 (order: 6, 262144 bytes) [ 0.205963] TCP bind hash table entries: 32768 (order: 7, 524288 bytes) [ 0.206141] TCP: Hash tables configured (established 32768 bind 32768) [ 0.206207] TCP: reno registered [ 0.206240] UDP hash table entries: 2048 (order: 4, 65536 bytes) [ 0.206294] UDP-Lite hash table entries: 2048 (order: 4, 65536 bytes) [ 0.206415] NET: Registered protocol family 1 [ 0.206530] Unpacking initramfs... [ 0.586747] Freeing initrd memory: 16900k freed [ 0.592244] RAPL PMU: API unit is 2^-32 Joules, 3 fixed counters, 163840 ms ovfl timer [ 0.592262] RAPL PMU: hw unit of domain pp0-core 2^-16 Joules [ 0.592269] RAPL PMU: hw unit of domain package 2^-16 Joules [ 0.592275] RAPL PMU: hw unit of domain dram 2^-16 Joules [ 0.592423] platform rtc_cmos: registered platform RTC device (no PNP device found) [ 0.594065] sha1_ssse3: Using AVX optimized SHA-1 implementation [ 0.594310] sha256_ssse3: Using AVX optimized SHA-256 implementation [ 0.595043] futex hash table entries: 1024 (order: 4, 65536 bytes) [ 0.595075] Initialise system trusted keyring [ 0.595117] audit: initializing netlink socket (disabled) [ 0.595156] type=2000 audit(1515443217.801:1): initialized [ 0.620696] HugeTLB registered 2 MB page size, pre-allocated 0 pages [ 0.621772] zpool: loaded [ 0.621785] zbud: loaded [ 0.621995] VFS: Disk quotas dquot_6.5.2 [ 0.622063] Dquot-cache hash table entries: 512 (order 0, 4096 bytes) [ 0.622291] msgmni has been set to 7996 [ 0.622380] Key type big_key registered [ 0.623722] NET: Registered protocol family 38 [ 0.623739] Key type asymmetric registered [ 0.623750] Asymmetric key parser 'x509' registered [ 0.623802] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 250) [ 0.623881] io scheduler noop registered [ 0.623893] io scheduler deadline registered (default) [ 0.623959] io scheduler cfq registered [ 0.624098] pci_hotplug: PCI Hot Plug PCI Core version: 0.5 [ 0.624115] pciehp: PCI Express Hot Plug Controller Driver version: 0.4 [ 0.624923] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled [ 0.625877] Non-volatile memory driver v1.3 [ 0.625979] Linux agpgart interface v0.103 [ 0.626195] crash memory driver: version 1.1 [ 0.626308] rdac: device handler registered [ 0.626459] hp_sw: device handler registered [ 0.626475] emc: device handler registered [ 0.626486] alua: device handler registered [ 0.626558] libphy: Fixed MDIO Bus: probed [ 0.626669] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver [ 0.626690] ehci-pci: EHCI PCI platform driver [ 0.626714] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver [ 0.626731] ohci-pci: OHCI PCI platform driver [ 0.626753] uhci_hcd: USB Universal Host Controller Interface driver [ 0.626845] usbcore: registered new interface driver usbserial [ 0.626866] usbcore: registered new interface driver usbserial_generic [ 0.626886] usbserial: USB Serial support registered for generic [ 0.626930] i8042: PNP: No PS/2 controller found. Probing ports directly. [ 1.644938] i8042: No controller found [ 1.645173] mousedev: PS/2 mouse device common for all mice [ 1.705613] rtc_cmos rtc_cmos: rtc core: registered rtc_cmos as rtc0 [ 1.705744] rtc_cmos: probe of rtc_cmos failed with error -38 [ 1.705823] dmi-sysfs: dmi entry is absent. [ 1.705849] hidraw: raw HID events driver (C) Jiri Kosina [ 1.705993] usbcore: registered new interface driver usbhid [ 1.706020] usbhid: USB HID core driver [ 1.706055] drop_monitor: Initializing network drop monitor service [ 1.706132] TCP: cubic registered [ 1.706142] Initializing XFRM netlink socket [ 1.706246] NET: Registered protocol family 10 [ 1.706578] NET: Registered protocol family 17 [ 1.706803] microcode: CPU0 sig=0x206d7, pf=0x1, revision=0x710 [ 1.706837] microcode: CPU1 sig=0x206d7, pf=0x1, revision=0x710 [ 1.706858] microcode: CPU2 sig=0x206d7, pf=0x1, revision=0x710 [ 1.706884] microcode: CPU3 sig=0x206d7, pf=0x1, revision=0x710 [ 1.707034] microcode: Microcode Update Driver: v2.01 < tigran(a)aivazian.fsnet.co.uk>, Peter Oruba [ 1.707334] Loading compiled-in X.509 certificates [ 1.707368] Loaded X.509 cert 'CentOS Linux kpatch signing key: ea0413152cde1d98ebdca3fe6f0230904c9ef717' [ 1.707391] Loaded X.509 cert 'CentOS Linux Driver update signing key: 7f421ee0ab69461574bb358861dbe77762a4201b' [ 1.707980] Loaded X.509 cert 'CentOS Linux kernel signing key: 2bade9ee54e382c6692955a95011589b663d6aef' [ 1.708025] registered taskstats version 1 [ 1.710526] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff816bc62d [ 1.710526] [ 1.710543] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 3.10.0-693.11.6.el7.centos.plus.x86_64 #1 [ 1.710551] Call Trace: [ 1.710561] [<ffffffff816b6e74>] dump_stack+0x19/0x1b [ 1.710569] [<ffffffff816b0d37>] panic+0xe8/0x20d [ 1.710576] [<ffffffff816bc62d>] ? __schedule+0x95d/0x9b0 [ 1.710584] [<ffffffff810ca4d0>] ? switched_to_idle+0x10/0x10 [ 1.710590] [<ffffffff810891bb>] __stack_chk_fail+0x1b/0x20 [ 1.710596] [<ffffffff816bc62d>] __schedule+0x95d/0x9b0 [ 1.710603] [<ffffffff816c4801>] ? __do_page_fault+0x171/0x450 [ 1.710611] [<ffffffff816c4b15>] ? do_page_fault+0x35/0x90 [ 1.710617] [<ffffffff816c08f8>] ? page_fault+0x28/0x30 [ 1.710623] [<ffffffff816c0dda>] ? error_exit+0x2a/0x60 [ 1.710630] [<ffffffff816c053a>] ? retint_swapgs+0x5/0x6

1 0

CentOS-virt - Kernel Side-Channel Attacks
by rikske＠deds.nl 08 Jan '18

08 Jan '18

Please patch the CentOS-virt Kernel to fix the Kernel Side-Channel Attacks vulnerabilities. The latest CentOS-virt kernel was released in November, as seen below. kernel-4.9.63-29.el7.x86_64.rpm 2017-11-21 13:30 https://access.redhat.com/security/vulnerabilities/speculativeexecution http://mirror.centos.org/centos/7/virt/x86_64/xen/

6 5

Centos 6 2.6.32-696.18.7.el6.x86_64 does not boot in Xen PV mode
by Sarah Newman 06 Jan '18

06 Jan '18

Problems start before any of the kaiser code executes, though it could still be related to CONFIG_KAISER since that has effects beyond kaiser.c. --- (early) Initializing cgroup subsys cpuset (early) Initializing cgroup subsys cpu (early) Linux version 2.6.32-696.18.7.el6.x86_64 (mockbuild(a)c1bl.rdu2.centos.org) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-18) (GCC) ) #1 SMP Thu Jan 4 17:31:22 UTC 2018 (early) Command line: ro console=hvc0 rootflags=barrier=0 crashkernel=auto SYSFONT=latarcyrheb-sun16 LANG=en_US.UTF-8 KEYTABLE=us earlyprintk=xen (early) KERNEL supported cpus: (early) Intel GenuineIntel (early) AMD AuthenticAMD (early) Centaur CentaurHauls (early) 1 multicall(s) failed: cpu 0 (early) Pid: 0, comm: swapper Not tainted 2.6.32-696.18.7.el6.x86_64 #1 (early) Call Trace: (early) [<ffffffff81004843>] ? xen_mc_flush+0x1c3/0x250 (early) [<ffffffff81006b9e>] ? xen_extend_mmu_update+0xde/0x1b0 (early) [<ffffffff81006fcd>] ? xen_set_pmd_hyper+0x9d/0xc0 (early) [<ffffffff81c5e8ac>] ? early_ioremap_init+0x98/0x133 (early) [<ffffffff81c45221>] ? setup_arch+0x40/0xca6 (early) [<ffffffff8107e0ee>] ? vprintk_default+0xe/0x10 (early) [<ffffffff8154b0cd>] ? printk+0x4f/0x52 (early) [<ffffffff81c3fdda>] ? start_kernel+0xdc/0x43b (early) [<ffffffff81c47eb0>] ? reserve_early+0x30/0x39 (early) [<ffffffff81c3f33a>] ? x86_64_start_reservations+0x125/0x129 (early) [<ffffffff81c4309c>] ? xen_start_kernel+0x4fe/0x505 (early) ------------[ cut here ]------------ (early) WARNING: at arch/x86/xen/multicalls.c:182 xen_mc_flush+0x21f/0x250() (Not tainted) (early) Modules linked in: (early) Pid: 0, comm: swapper Not tainted 2.6.32-696.18.7.el6.x86_64 #1 (early) Call Trace: (early) [<ffffffff8107ce81>] ? warn_slowpath_common+0x91/0xe0 (early) [<ffffffff8100762f>] ? __raw_callee_save_xen_restore_fl+0x11/0x1e (early) [<ffffffff8107ceea>] ? warn_slowpath_null+0x1a/0x20 (early) [<ffffffff8100489f>] ? xen_mc_flush+0x21f/0x250 (early) [<ffffffff81006b9e>] ? xen_extend_mmu_update+0xde/0x1b0 (early) [<ffffffff81006b9e>] ? xen_extend_mmu_update+0xde/0x1b0 (early) [<ffffffff81006fcd>] ? xen_set_pmd_hyper+0x9d/0xc0 (early) [<ffffffff81c5e8ac>] ? early_ioremap_init+0x98/0x133 (early) [<ffffffff81c45221>] ? setup_arch+0x40/0xca6 (early) [<ffffffff8107e0ee>] ? vprintk_default+0xe/0x10 (early) [<ffffffff8154b0cd>] ? printk+0x4f/0x52 (early) [<ffffffff81c3fdda>] ? start_kernel+0xdc/0x43b (early) [<ffffffff81c47eb0>] ? reserve_early+0x30/0x39 (early) [<ffffffff81c3f33a>] ? x86_64_start_reservations+0x125/0x129 (early) [<ffffffff81c4309c>] ? xen_start_kernel+0x4fe/0x505 (early) ---[ end trace a7919e7f17c0a725 ]--- (early) ACPI in unprivileged domain disabled (early) released 0 pages of unused memory (early) BIOS-provided physical RAM map: (early) Xen: 0000000000000000 - 00000000000a0000 (usable) (early) Xen: 00000000000a0000 - 0000000000100000 (reserved) (early) Xen: 0000000000100000 - 0000000020000000 (usable) (early) bootconsole [xenboot0] enabled

3 4

[CVE-2017-5715] qemu-kvm-ev-2.9.0-16.el7_4.13.1 is now available for testing
by Sandro Bonazzola 04 Jan '18

04 Jan '18

Hi, qemu-kvm-ev-2.9.0-16.el7_4.13.1 <https://cbs.centos.org/koji/buildinfo?buildID=21119> is now available for testing. I'm testing it right now in oVirt CI, if nothing shows up, I'll tag it for release in a few hours. Here's the changelog: * Thu Jan 04 2018 Sandro Bonazzola <sbonazzo(a)redhat.com> - ev-2.9.0-16.el7_4.13.1 - Removing RH branding from package name * Thu Dec 14 2017 Miroslav Rezanina <mrezanin(a)redhat.com> - rhev-2.9.0-16.el7_4.13 - Fix CVE-2017-5715 * Thu Nov 16 2017 Miroslav Rezanina <mrezanin(a)redhat.com> - rhev-2.9.0-16.el7_4.12 - kvm-util-async-use-atomic_mb_set-in-qemu_bh_cancel.patch [bz#1513362] - Resolves: bz#1513362 (QEMU's AIO subsystem gets stuck inhibiting all I/O operations on virtio-blk-pci devices [rhel-7.4.z]) -- SANDRO BONAZZOLA ASSOCIATE MANAGER, SOFTWARE ENGINEERING, EMEA ENG VIRTUALIZATION R&D Red Hat EMEA <https://www.redhat.com/> <https://red.ht/sig> TRIED. TESTED. TRUSTED. <https://redhat.com/trusted>

1 1

spice server and GSSAPI
by Ranbir 30 Dec '17

30 Dec '17

Hello, Does anyone have spice server for KVM Linux guests working with GSSAPI authentication? I've been trying for a while and I simply can't get it to work. I don't know what I'm doing wrong. I wouldn't be surprised if I've misunderstood something. I followed this guide: https://www.freeipa.org/page/Libvirt_with_VNC_Consoles Yes, the above is for VNC consoles. I just adapted that write up for spice. When I try to connect to a console from either virt-manager or with virt-viewer, I'm prompted to enter a password (though I shouldn't be). When I type in my freeipa domain password, it gets rejected. libvirtd with Kerberos and GSSAPI is working perfectly. I can use virt-manager from my Fedora 26 desktop with the below URI: qemu+tcp://ranbir@kvmhost01/system virt-manager connects, I get a list of all the running KVMs and I can work with them like I would if I was running virt-manager over ssh with X forwarding. The only that doesn't work is viewing the consoles. Details: - my host is a fully updated CentOS 7 system - libvirtd is set to listen for tcp connections - I added the service spice/kvmhost01.theinside.rnr - I created a keytab for the above and put it on kvmhost01 in /etc/qemu-kvm/krb5.tab - the above file has owner:group set to qemu:root with perms 600 - I have the following in /etc/sasl2/qemu-kvm.conf mech_list: gssapi keytab: /etc/qemu-kvm/krb5.tab - I have the following in /etc/libvirt/qemu.conf spice_listen = "0.0.0.0" spice_tls = 0 spice_sasl = 1 spice_sasl_dir = "/etc/sasl2/" - the first time I try to view a console, I get the kerberos tickets I expect to: Ticket cache: KEYRING:persistent:625400004:krb_ccache_7rtJmh8 Default principal: ranbir(a)THEINSIDE.RNR Valid starting Expires Service principal 2017-12-29 18:37:45 2017-12-30 18:01:40 spice/kvmhost01.theinside.rnr(a)THEINSIDE.RNR 2017-12-29 18:37:40 2017-12-30 18:01:40 libvirt/kvmhost01.theinside.rnr(a)THEINSIDE.RNR 2017-12-29 18:01:40 2017-12-30 18:01:40 krbtgt/THEINSIDE.RNR(a)THEINSIDE.RNR I'm surprised there isn't more info available about this online. That's why I'm now here asking for assistance. Does anyone have any suggestions/advice? Thanks in advance! -- Ranbir

1 1

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

virt